---
id: "CVE-2026-77156"
kind: "vulnerability"
aliases: ["CVE-2026-77156"]
title: "ast-cli: tar extraction lets archive entries write outside install directory"
severity: "medium"
cvss: 6.4
epss: 0.00349
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ast-cli", "checkmarx", "ci-cd", "linux", "macos", "package"]
not_affected_if: ["no-ast-cli-install", "windows"]
published_at: "2026-10-22T18:17:29+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:59:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77156", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77156", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# ast-cli: tar extraction lets archive entries write outside install directory

ast-cli's tar extraction on Linux and macOS does not fully validate entry paths, so a crafted archive with absolute or traversal paths can write files outside the install directory. Exploitation requires an attacker to replace the archive served from download.checkmarx.com, after which arbitrary executable files can be written to arbitrary paths.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ast-cli version with `ast-cli --version` (exact affected version range unknown)
- Look for ast-cli or Vorpal ASCA / SCA Resolver installs on Linux or macOS hosts and review the install directory
- Confirm whether the install step pulls archives from download.checkmarx.com

## Fix

- Upgrade ast-cli to a release that includes the fix (fixed version unknown from sources)
- Reinstall the Vorpal ASCA real-time engine and SCA Resolver after upgrading
- Verify the install directory and check for unexpected files written outside it

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77156
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77156

## From the sources

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.



Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.



Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_